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AMENDMENTS TO THE CLAIMS 

This listing of claims will replace all prior versions, and listings, of claims in 
the application: 

Listing of Claims 

Original claims 1-22 and amended claims 1-21 are cancelled. 

Claim 23 (new): A method for the automatic online detection and 
classification of anomalous objects in a data stream, comprising the steps of: 

a) detecting at least one incoming data stream containing normal and 
anomalous objects, 

b) constmcting a geometric representation of normality of the incoming 
objects of the data stream at a time (ti) subject to at least one predefined optimality 
conditions, 

c) geometrically representing an optimal normality, 

d) adapting the geometric representation of normality in respect to at least 
one received object at a time (t2), which is greater than ti, wherein the adaptation is subject to 
at least one predefined optimality condition, 

e) determining a normality/anomality classification for received objects at 
t2 in respect to the geometric representation of normality, 

f) classifying normal objects and anomalous objects based on the 
generated normaUty classification and generating a data set describing the anomalous data for 
further processing. 

Claim 24 (new): The method according to claim 23, wherein the 
geometric representation of normality is a parametric boundary hypersurface using the 
enclosure of the minimal volxime or the minimal volume estimate among all possible surfaces 
as an optimality condition. 

Claim 25 (new): The method according to claim 24, wherein the 
hypersurface is constructed in the space of original measurements of least one incoming data 
stream or in a space obtained by a nonlinear transformation thereof. 
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Claim 26 (new): The method according to claim 23, wherein the 
optimality condition, used to construct the parametric boundary hypersurface, is a predefined 
condition. 

Claim 27 (new): The method according to claim 23, wherein the 
anomalous objects are determined as the ones lying outside of the geometrical representation 
of normality. 

Claim 28 (new): The method according to claim 23, wherein the 
adaptation of the geometric representation of normality comprises an automatic adjustment of 
parameters Xi of the geometric representation of normality to incorporate at least one new 
object while maintaining the optimality of the geometric representation of normahty. 

Claim 29 (new): The method according to claim 23, wherein the 
adaptation of the geometric representation of normality comprises an automatic adjustment of 
parameters Xi of the geometric representation of normality to remove the least-relevant object, 
while maintaining the optimality of the geometric representation of normality. 

Claim 30 (new): The method according to claim 23, wherein the 
geometric representation of normality is generated with a Support Vector Machine method, 
generating a parametric vector x to describe the representation. 

Claim 31 (new): The method according to claim 23, wherein a temporal 
change of the geometrical representation of normality is stored for the evaluation of temporal 
trend in the data stream. 

Claim 32 (new): The method according to claim 23, wherein the 
geometric representation of normality is a sphere or any part thereof. 

Claim 33 (new): The method according to claim 23, wherein the 
incoming data stream comprises data packets in communication networks or representations 
thereof. 
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Claim 34 (new): The method according to claim 23, wherein the data 
objects comprise entries originating from the logging in process in at least one computer or 
representations thereof. 

Claim 35 (new): The method according to claim 33, wherein the 
determination of normality of the received data packets distinguishes normal incoming data 
stream from anomalous data, whereby a means for determining the normal and anomalous 
data generates a warning message. 

Claim 36 (new): The method according to claim 23, wherein the 
construction and update of the geometric representation of normality in which the coordinate 
system in which the representation is constructed is fixed to some point in the data space or in 
the feature space. 

Claim 37 (new): The method according to claim 36, wherein the center 
of the coordinate system coincides with the center of mass of the data space in the original or 
in the feature space. 

Claim 38 (new): The method according to claim 36, wherein the decision 
on normality or anomality of an object is decided upon its norm in a data-centered coordinate 
system, a feature-space-centered coordinate system, or by the radius of the hypershere 
centered at the center of the origin in the coordinate system and encompassing the given 
objects. 

Claim 39 (new): The method according to claim 36, wherein the update 
of the representation includes the update of the coordinate system. 

Claim 40 (new): The method according to claim 36, wherein the update 
of coordinate system includes the update of a center of coordinates. 
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Claim 41 (new): The method according to claim 36, wherein importation 
of a new object is included as a part of the update of the norms of all objects in the working 
set so as to bring them in the new coordinate system corresponding to an expanded working 
set. 

Claim 42 (new): The method according to claim 37, wherein removal of 
the object is included as a part of the update of the norms of all objects in the working set so 
as to bring them in the new coordinate system corresponding to a contracted working set. 

Claim 43 (new): A system for the automatic online detection and 
classification of anomalous objects in a data system, comprising: 

a) a detecting means for detecting at least one incoming data stream 
containing normal and anomalous objects, 

b) an automatic online anomaly detection engine, comprising: 

an automatic construction means for constructing a geometric 
representation of normality for the incoming objects of the data stream 
at a time (ti) subject to at least one predefined optimality condition, 
with an automatic online adaptation means for adapting the geometric 
representation of normality in respect to received at least one received 
object at a time (t2), which is greater than ti, the adaptation being 
subject to at least one predefined optimality condition, 

a means for geometrically representing an optimal normality, 

and 

an automatic online determination means for determining a 
normality classification for received objects at tz in respect to the 
geometric representation of normality, and 

c) an automatic classification means for classifying normal objects and 
anomalous objects based on the generated normality classification and generating a data set 
describing the anomalous data for fiirther processing. 
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